SCS-C02 Threat Detection and Incident Response Practice Test 13 — 15 Questions

Question 1

A security engineer is configuring an automated incident response workflow. When a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' is generated, the workflow should isolate the EC2 instance and snapshot its EBS volume. Which AWS service can coordinate these actions?

Accepted Answer

AWS Step Functions. AWS Step Functions can orchestrate multiple actions (isolation, snapshot) in a workflow triggered by EventBridge. Option A (Lambda) can do one action but chaining requires custom code. Option B (Config) is for rules. Option D (CloudFormation) is for infrastructure.

Answer

AWS Lambda functions invoked sequentially

Answer

AWS CloudFormation

Answer

AWS Config rules with auto-remediation

Question 2

A company has a requirement to detect and alert on S3 objects that contain personally identifiable information (PII) being shared publicly. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3. Option B (GuardDuty) detects threats, not data classification. Option C (Inspector) is for vulnerabilities. Option D (CloudWatch) is for monitoring.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 3

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to identify which of the following actions should be taken during the forensic analysis phase? (Select TWO.)

Accepted Answer

Take a manual snapshot of the RDS instance.. Option D is correct because taking a manual snapshot preserves a point-in-time, immutable copy of the RDS instance for offline forensic analysis without altering the live database. This ensures that evidence is captured before any changes occur during the investigation, and the snapshot can be restored to a separate instance for safe examination.

Answer

Enable automatic backups if not already enabled.

Answer

Disable deletion protection to allow cleanup.

Answer

Modify the security group to restrict database access.

Question 4

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 5

A security engineer is configuring Amazon GuardDuty to generate alerts for specific threat types. The engineer wants to ensure that alerts are sent to the security team's email distribution list and also trigger an automated Lambda function for immediate response. Which two actions should the engineer take? (Select TWO.)

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers a Lambda function.. Option A is correct because Amazon EventBridge (formerly CloudWatch Events) can be configured with a rule that matches GuardDuty finding events. When a finding matches the rule pattern, EventBridge can directly invoke a Lambda function for automated incident response, such as isolating a compromised instance or updating security groups.

Answer

Configure Amazon CloudWatch Logs to send log events to an email distribution list.

Answer

Create an Amazon CloudWatch Events rule to route findings to a Lambda function.

Answer

Create an Amazon Simple Queue Service (SQS) queue and have the Lambda function poll the queue.

Question 6

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 7

A company uses AWS Organizations to manage multiple accounts. The security team wants to centralize threat detection across all accounts. They enable Amazon GuardDuty in the management account and intend to use delegated administrator functionality. However, they find that GuardDuty is not detecting threats in member accounts. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts. The security team must invite member accounts or use the delegated administrator to enable GuardDuty in all accounts.. Option B is correct because Amazon GuardDuty must be enabled in each member account to detect threats in those accounts. When using the delegated administrator model, the security team can enable GuardDuty across all accounts programmatically via the delegated administrator API, but they must explicitly perform this action. Simply enabling GuardDuty in the management account does not automatically activate it in member accounts, which is why no threats are detected in those accounts.

Answer

GuardDuty requires an S3 bucket in each account to store findings.

Answer

GuardDuty only monitors the management account's resources, not member accounts.

Answer

GuardDuty does not support delegated administrator for AWS Organizations.

Question 8

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

Accepted Answer

Modify the security group associated with the instance to remove all inbound and outbound rules.. Modifying the security group to deny all traffic is the quickest way to isolate an instance while keeping it running. Detaching the instance stops it and may lose volatile data. Deleting the instance destroys evidence. Changing network ACLs affects the entire subnet, not just the instance.

Answer

Detach the instance from the Auto Scaling group and stop it.

Answer

Update the network ACL for the subnet to deny all traffic.

Answer

Terminate the instance immediately.

Question 9

A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?

Accepted Answer

The filter pattern does not include the eventSource field, so it might match events from other services.. CloudTrail logs are JSON objects. The filter pattern must match the JSON structure. The correct pattern should include the eventSource or use the proper path. Typically, the pattern should be `{ ($.eventSource = "iam.amazonaws.com") && ($.eventName = "CreateAccessKey") }`. Without eventSource, the filter may match other services with the same event name.

Answer

The filter pattern syntax is incorrect; it should use square brackets.

Answer

The metric filter is not associated with the correct log group.

Answer

CloudWatch Logs does not support metric filters for CloudTrail logs.

Question 10

A company is using AWS Lambda functions to process sensitive data. The security team wants to detect when a Lambda function is invoked with an unexpected payload that may indicate an injection attack. Which AWS service should the team use to inspect the function's input for malicious patterns?

Accepted Answer

None of the above; the team should implement custom validation within the Lambda function.. Option B is correct because AWS Lambda functions process event payloads directly within the function code, and no AWS managed service can inspect the actual input data passed to a Lambda function at invocation time. AWS WAF operates at the HTTP/HTTPS layer for API Gateway or CloudFront, not for Lambda function payloads. Amazon Inspector scans for software vulnerabilities in EC2 instances and container images, not runtime payloads. AWS Shield provides DDoS protection at the network and transport layers. Amazon GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail events for threats, but it does not inspect Lambda function invocation payloads. Therefore, the only way to detect malicious patterns in the function's input is to implement custom validation logic within the Lambda function code itself.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 11

A company wants to automate the response to a specific GuardDuty finding. When GuardDuty detects a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, they want to automatically block the offending IP address using a network ACL. Which AWS service can they use to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation can be used to run predefined runbooks that modify network ACLs. AWS Config is for compliance, not automation. AWS CloudFormation is for infrastructure as code. AWS Lambda can be used but requires custom code; Systems Manager Automation provides a managed solution.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS CloudFormation

Question 12

A security engineer is reviewing AWS CloudTrail logs and notices a large number of `DescribeInstances` API calls from a single IAM user in a short period. The engineer suspects a credential compromise. What is the most effective way to automatically revoke the compromised credentials and notify the security team?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to revoke the keys and send an SNS notification.. AWS CloudTrail can trigger a Lambda function via CloudWatch Events (now Amazon EventBridge). The Lambda function can then revoke the IAM user's keys and notify via SNS. AWS Config cannot revoke keys. IAM does not have built-in automatic revocation based on CloudTrail events. GuardDuty provides findings but does not automatically revoke credentials.

Answer

Use AWS CloudTrail to automatically disable the IAM user's access keys.

Answer

Create an AWS Config rule that checks for excessive API calls and revokes keys.

Answer

Enable Amazon GuardDuty to automatically revoke compromised credentials.

Question 13

A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 14

A company uses Amazon RDS for its database. The security team needs to detect when a database instance is started or stopped outside of maintenance windows. Which AWS service should the team use to monitor these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including StartDBInstance and StopDBInstance calls from the RDS service. By monitoring CloudTrail logs, the security team can detect when a database instance is started or stopped outside of maintenance windows, as each API call is logged with a timestamp and user identity. CloudTrail is specifically designed for auditing API calls, making it the appropriate tool for this use case.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

AWS Config

Question 15

A company uses AWS CloudTrail to log all API activity. The security team wants to detect when an IAM user creates an access key for another user, which is a potential privilege escalation. Which TWO actions should the team take to set up this detection?

Accepted Answer

Create a CloudWatch alarm based on the metric filter.. Option B is correct because a CloudWatch alarm based on a metric filter allows the security team to monitor CloudTrail logs in real time and trigger an alert when a specific API call (CreateAccessKey) is made by an IAM user for another user. The metric filter extracts the event from CloudTrail logs stored in CloudWatch Logs, and the alarm evaluates the metric against a threshold to notify the team of potential privilege escalation.

Answer

Create an AWS Config managed rule to detect CreateAccessKey calls.

Answer

Enable Amazon GuardDuty and create a custom threat list.